Headline
Ubuntu Security Notice USN-6889-1
Ubuntu Security Notice 6889-1 - It was discovered that .NET did not properly handle object deserialization. An attacker could possibly use this issue to cause a denial of service. Radek Zikmund discovered that .NET did not properly manage memory. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. It was discovered that .NET did not properly parse X.509 Content and ObjectIdentifiers. An attacker could possibly use this issue to cause a denial of service.
==========================================================================
Ubuntu Security Notice USN-6889-1
July 09, 2024
dotnet6, dotnet8 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in dotnet6, dotnet8.
Software Description:
- dotnet8: .NET CLI tools and runtime
- dotnet6: .NET CLI tools and runtime
Details:
It was discovered that .NET did not properly handle object
deserialization. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-30105)
Radek Zikmund discovered that .NET did not properly manage memory. An
attacker could use this issue to cause a denial of service or possibly
execute arbitrary code. (CVE-2024-35264)
It was discovered that .NET did not properly parse X.509 Content and
ObjectIdentifiers. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-38095)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
aspnetcore-runtime-8.0 8.0.7-0ubuntu1~24.04.1
dotnet-host-8.0 8.0.7-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 8.0.7-0ubuntu1~24.04.1
dotnet-runtime-8.0 8.0.7-0ubuntu1~24.04.1
dotnet-sdk-8.0 8.0.107-0ubuntu1~24.04.1
dotnet8 8.0.107-8.0.7-0ubuntu1~24.04.1
Ubuntu 23.10
aspnetcore-runtime-6.0 6.0.132-0ubuntu1~23.10.1
aspnetcore-runtime-8.0 8.0.7-0ubuntu1~23.10.1
dotnet-host 6.0.132-0ubuntu1~23.10.1
dotnet-host-8.0 8.0.7-0ubuntu1~23.10.1
dotnet-hostfxr-6.0 6.0.132-0ubuntu1~23.10.1
dotnet-hostfxr-8.0 8.0.7-0ubuntu1~23.10.1
dotnet-runtime-6.0 6.0.132-0ubuntu1~23.10.1
dotnet-runtime-8.0 8.0.7-0ubuntu1~23.10.1
dotnet-sdk-6.0 6.0.132-0ubuntu1~23.10.1
dotnet-sdk-8.0 8.0.107-0ubuntu1~23.10.1
dotnet6 6.0.132-0ubuntu1~23.10.1
dotnet8 8.0.107-8.0.7-0ubuntu1~23.10.1
Ubuntu 22.04 LTS
aspnetcore-runtime-6.0 6.0.132-0ubuntu1~22.04.1
aspnetcore-runtime-8.0 8.0.7-0ubuntu1~22.04.1
dotnet-host 6.0.132-0ubuntu1~22.04.1
dotnet-host-8.0 8.0.7-0ubuntu1~22.04.1
dotnet-hostfxr-6.0 6.0.132-0ubuntu1~22.04.1
dotnet-hostfxr-8.0 8.0.7-0ubuntu1~22.04.1
dotnet-runtime-6.0 6.0.132-0ubuntu1~22.04.1
dotnet-runtime-8.0 8.0.7-0ubuntu1~22.04.1
dotnet-sdk-6.0 6.0.132-0ubuntu1~22.04.1
dotnet-sdk-8.0 8.0.107-0ubuntu1~22.04.1
dotnet6 6.0.132-0ubuntu1~22.04.1
dotnet8 8.0.107-8.0.7-0ubuntu1~22.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6889-1
CVE-2024-30105, CVE-2024-35264, CVE-2024-38095
Package Information:
https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~24.04.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.132-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.132-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~22.04.1
Related news
Red Hat Security Advisory 2024-4451-03 - An update for dotnet8.0 is now available for Red Hat Enterprise Linux 8. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-4450-03 - An update for dotnet8.0 is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-4439-03 - An update for dotnet6.0 is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-4438-03 - An update for dotnet6.0 is now available for Red Hat Enterprise Linux 8. Issues addressed include a denial of service vulnerability.
Microsoft has released patches to address a total of 143 security flaws as part of its monthly security updates, two of which have come under active exploitation in the wild. Five out of the 143 flaws are rated Critical, 136 are rated Important, and four are rated Moderate in severity. The fixes are in addition to 33 vulnerabilities that have been addressed in the Chromium-based Edge browser
# Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Vulnerability exists when System.Formats.Asn1 in .NET parses an X.509 certificate or collection of certificates, a malicious certificate can result in excessive CPU consumption on all platforms result in Denial of Service. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/312 ## <a name="mitigation-factors"></a>Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.31 or earlier. * Any .NET 8.0 application runni...
# Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Vulnerability exists in ASP.NET Core 8 where Data Corruption in Kestrel HTTP/3 can result in remote code execution. Note: HTTP/3 is experimental in .NET 6.0. If you are on .NET 6.0 and using HTTP/3, please upgrade to .NET 8.0.7 ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/314 ## <a name="mitigation-factors"></a>Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. ## <a name="affected-software"></a>Affected software * Any .NET 8.0 application running on .NET 8.0.6 or earlier. ## <a name="affected-packages"></a...
# Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET when calling the JsonSerializer.DeserializeAsyncEnumerable method against an untrusted input using System.Text.Json may result in Denial of Service. ## Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/104619 ## <a name="mitigation-factors"></a>Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. ## <a name="affected-software"></a>Affected software * Any .NET 8.0 application running on .NET 8.0.6 or earlier. ## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NE...